Skip to content
ICASecuring WorkloadsSingle nodeMedium

Allow one service account to call two paths

Scenario ica-sec-002 · about 8 minutes · 8 points · 4 grader checks

Write an ALLOW AuthorizationPolicy that admits a single workload identity for GET on two paths and nothing else.

  • authorizationpolicy
  • allow
  • principals
  • spiffe
  • securing-workloads

What you will practise

  • Select a workload with an AuthorizationPolicy
  • Match a caller by its mTLS principal
  • Restrict methods and paths with operation rules

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start ica-sec-002

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Istio is installed. Namespace "payments" is in the mesh and runs the Service "api" (port 8000, pods labelled app=api) and the client Deployments "curl" (ServiceAccount "curl") and "intruder" (ServiceAccount "intruder"). Create an AuthorizationPolicy "api-allow-curl" in "payments" for the pods with label app=api so that only requests from the ServiceAccount "curl" of namespace "payments", with method GET, on the paths /get and /headers are allowed. Every other request to "api" must be denied.

Requirements and details

Certification
ICA · Istio Certified Associate
Domain
Securing Workloads
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
8 minutes
Points
8
Grader checks
4
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 4 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Securing Workloads labs

ICASecuring WorkloadsEasy

Mesh-wide strict mTLS with a namespace exception

Require mutual TLS for the whole mesh while one legacy namespace keeps accepting plain text.

Single node · ~7 min · 7 points

  • mtls
  • peerauthentication
  • strict
  • permissive
  • securing-workloads

goldenkube start ica-sec-001

ICASecuring WorkloadsHard

Require a valid JWT for a workload

Validate end-user JWTs with a RequestAuthentication and an inline key set, and deny requests that carry no token.

Single node · ~9 min · 9 points

  • jwt
  • requestauthentication
  • authorizationpolicy
  • request-principals
  • securing-workloads

goldenkube start ica-sec-003

ICASecuring WorkloadsHard

Terminate TLS at the ingress gateway with an HTTPS redirect

Serve a host over HTTPS at the ingress gateway from a Kubernetes TLS secret and redirect plain HTTP to HTTPS.

Single node · ~10 min · 10 points

  • gateway
  • tls
  • https-redirect
  • credentialname
  • securing-workloads

goldenkube start ica-sec-004

ICASecuring WorkloadsMedium

Deny by default, allow reads, deny one caller

Combine a namespace-wide deny-all with an ALLOW and a DENY AuthorizationPolicy and reason about their evaluation order.

Single node · ~9 min · 9 points

  • authorizationpolicy
  • deny-by-default
  • allow-nothing
  • deny
  • securing-workloads

goldenkube start ica-sec-005

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.